AngularJS Cross-site Scripting due to failure to sanitize `xlink.href` attributes

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-14863 · ADVISORY
• angular/angular.js#12524 · WEB
• angular/angular.js commit 35a2153 · WEB
• angular/angular.js commit f33ce17 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• angular/angular.js · PACKAGE
• snyk.io/vuln/npm:angular:20150807 · WEB
• npmjs.com/advisories/1453 · WEB

angularjs のその他の脆弱性

• CVE-2024-8373中 4.3Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image …
• CVE-2024-8372中 4.3Improper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which…
• CVE-2023-26118中 5.3Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element…
• CVE-2023-26117中 5.3Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to t…
• CVE-2023-26116中 5.3Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility fu…